@EtherMan said in Konnectd with ldaps fails verification but no setting for allowing.:
Though I must point out that “by using a secure CA and together with secure DNS, you can be sure that the connection is made to the desired system and to that system only.” is in no way true. DNS is inherently open to multiple vulnerabilities and injection attacks happen on a daily basis.
While this is generally the case, it should be a little different in your internal environment where you have full control of all involved resolvers.
@EtherMan said in Konnectd with ldaps fails verification but no setting for allowing.:
Since I’ll be using containers, I suppose the easiest solution is to mount in the CA as a secret in place of that file such that it only has a single CA in total. Would that work or are there external checks that it has to do that requires one of the standard CAs?
Yes, that should do it. Generally when using containers, it is recommended to mount the trusted CA’s from a location controlled by the local system. Most containers might not even ship any trusted CA.
@EtherMan said in Konnectd with ldaps fails verification but no setting for allowing.:
There’s the survey service that does, but that can be disabled and I’m unsure if that verifies identity though I assume it does.
The survey client uses the normal default CA list to discover if the connection is trusted. So it is effected by SSL_CERT_FILE and/or SSL_CERT_DIR. Since the survey client or its success is entirely optional, any runtime error it produces is not fatal.